diff --git a/.sqlx/query-dff74f6b34839e017e159ba35d59a978f73c0c883abf61888434d4b10e5c5a9b.json b/.sqlx/query-09de3026cd6a45b87bc747b3a704d7c025b4203ef40da5f90debd3bb9353b094.json
similarity index 96%
rename from .sqlx/query-dff74f6b34839e017e159ba35d59a978f73c0c883abf61888434d4b10e5c5a9b.json
rename to .sqlx/query-09de3026cd6a45b87bc747b3a704d7c025b4203ef40da5f90debd3bb9353b094.json
index 0c26f3ddf97..830b1ca82ee 100644
--- a/.sqlx/query-dff74f6b34839e017e159ba35d59a978f73c0c883abf61888434d4b10e5c5a9b.json
+++ b/.sqlx/query-09de3026cd6a45b87bc747b3a704d7c025b4203ef40da5f90debd3bb9353b094.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "with\n        accounts_root_user as (\n            -- Precondition: the accounts root user must exist.\n            -- Use a sub-select to select either one match or an explicit null row,\n            -- which will then fail a not-null constraint.\n            select (select id from auth.users where email = $4 limit 1) as accounts_id\n        ),\n        grant_user_admin_to_tenant as (\n            insert into user_grants (user_id, object_role, capability, detail) values\n                ($1, $2, 'admin', $3)\n            on conflict do nothing\n        ),\n        grant_to_tenant as (\n            insert into role_grants (subject_role, object_role, capability, detail) values\n                ($2, $2, 'write', $3),             -- Tenant specs may write to other tenant specs.\n                ($2, 'ops/dp/public/', 'read', $3) -- Tenant may access public data-planes.\n            on conflict do nothing\n        ),\n        public_planes as (\n            select json_agg(\n                data_plane_name\n                order by case when data_plane_name = 'ops/dp/public/aws-us-east-1-c1' then 0 else 1 end asc,\n                id desc\n            ) as arr\n            from data_planes\n            where starts_with(data_plane_name, 'ops/dp/public/')\n            and data_plane_name <> 'ops/dp/public/gcp-us-central1-c1'\n            and data_plane_name <> 'ops/dp/public/gcp-us-central1-c2'\n        ),\n        create_storage_mappings as (\n            insert into storage_mappings (catalog_prefix, spec, detail) values\n                ($2, json_build_object(\n                    'stores', '[{\"provider\": \"GCS\", \"bucket\": \"estuary-trial\", \"prefix\": \"collection-data/\"}]'::json,\n                    'data_planes', (select arr from public_planes)\n                ), $3),\n                ('recovery/' || $2, '{\"stores\": [{\"provider\": \"GCS\", \"bucket\": \"estuary-trial\"}]}', $3)\n            on conflict do nothing\n        ),\n        create_alert_subscription as (\n            insert into alert_subscriptions (catalog_prefix, email, include_alert_types)\n            values ($2, (select email from auth.users where id = $1 limit 1), $5)\n        )\n        insert into tenants (tenant, detail) values ($2, $3);\n        ",
+  "query": "with\n        accounts_root_user as (\n            -- Precondition: the accounts root user must exist.\n            -- Use a sub-select to select either one match or an explicit null row,\n            -- which will then fail a not-null constraint.\n            select (select id from auth.users where email = $4 limit 1) as accounts_id\n        ),\n        grant_user_admin_to_tenant as (\n            insert into user_grants (user_id, object_role, capability, detail) values\n                ($1, $2, 'admin', $3)\n            on conflict do nothing\n        ),\n        grant_to_tenant as (\n            insert into role_grants (subject_role, object_role, capability, detail) values\n                ($2, $2, 'write', $3),             -- Tenant specs may write to other tenant specs.\n                ($2, 'ops/dp/public/', 'read', $3) -- Tenant may access public data-planes.\n            on conflict do nothing\n        ),\n        public_planes as (\n            select json_agg(\n                data_plane_name\n                order by case when data_plane_name = 'ops/dp/public/aws-us-east-1-c2' then 0 else 1 end asc,\n                id desc\n            ) as arr\n            from data_planes\n            where starts_with(data_plane_name, 'ops/dp/public/')\n            and data_plane_name <> 'ops/dp/public/gcp-us-central1-c1'\n            and data_plane_name <> 'ops/dp/public/gcp-us-central1-c2'\n        ),\n        create_storage_mappings as (\n            insert into storage_mappings (catalog_prefix, spec, detail) values\n                ($2, json_build_object(\n                    'stores', '[{\"provider\": \"GCS\", \"bucket\": \"estuary-trial\", \"prefix\": \"collection-data/\"}]'::json,\n                    'data_planes', (select arr from public_planes)\n                ), $3),\n                ('recovery/' || $2, '{\"stores\": [{\"provider\": \"GCS\", \"bucket\": \"estuary-trial\"}]}', $3)\n            on conflict do nothing\n        ),\n        create_alert_subscription as (\n            insert into alert_subscriptions (catalog_prefix, email, include_alert_types)\n            values ($2, (select email from auth.users where id = $1 limit 1), $5)\n        )\n        insert into tenants (tenant, detail) values ($2, $3);\n        ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -49,5 +49,5 @@
     },
     "nullable": []
   },
-  "hash": "dff74f6b34839e017e159ba35d59a978f73c0c883abf61888434d4b10e5c5a9b"
+  "hash": "09de3026cd6a45b87bc747b3a704d7c025b4203ef40da5f90debd3bb9353b094"
 }
diff --git a/crates/control-plane-api/src/directives/beta_onboard.rs b/crates/control-plane-api/src/directives/beta_onboard.rs
index 262b9dd26c2..70d2138b892 100644
--- a/crates/control-plane-api/src/directives/beta_onboard.rs
+++ b/crates/control-plane-api/src/directives/beta_onboard.rs
@@ -64,6 +64,10 @@ pub async fn provision_tenant(
         .filter(models::status::AlertType::is_default)
         .collect();
 
+    // The first data-plane in this list becomes the tenant's default, because that's
+    // what validation picks when a publication doesn't name one. aws-us-east-1-c2 is
+    // sorted to the front: c1 is at capacity and is closed to new tenants.
+    //
     // Note that the gcp-us-central1-c1 (combustible-cronut) dataplane is excluded here
     // because it's being deprecated and replaced.
     sqlx::query!(
@@ -88,7 +92,7 @@ pub async fn provision_tenant(
         public_planes as (
             select json_agg(
                 data_plane_name
-                order by case when data_plane_name = 'ops/dp/public/aws-us-east-1-c1' then 0 else 1 end asc,
+                order by case when data_plane_name = 'ops/dp/public/aws-us-east-1-c2' then 0 else 1 end asc,
                 id desc
             ) as arr
             from data_planes